| 1 | Credential Theft | critical | js/bg.js (line 121) | The extension uses `chrome.identity.launchWebAuthFlow` (non-interactive) to silently obtain OAuth tokens by directing the flow to operator-controlled proxy servers. The token is then sent to those same servers via `/f… | |
| 2 | Data Exfiltration | critical | js/goanalitics.js (line 974) | Every visited URL, the previous URL (navigation chain), referrer, a persistent user ID, and a session ID are double-base64-encoded and POSTed to a server URL retrieved at runtime from `frigateblocklist.com/settings`. … | |
| 3 | Network Interception | critical | js/bg.js (line 266) | On startup, the extension fetches its initial proxy list from `proxyforfrigate.com/api/2/ru/proxy` — an external server entirely outside the user's control. The response is parsed and used to configure the browser's p… | |
| 4 | Obfuscation | critical | js/profiler.js (line 1) | The profiler immediately destructures built-in globals from `window` by local name — a common obfuscation technique to make static analysis harder. The string 'constructor' is never written literally but only assemble… | |
| 5 | Remote Code Loading | critical | js/profiler.js (line 9) | The variable `k` is constructed via character codes and decodes to the string 'constructor'. The `debug` function uses `Promise[k]` — i.e., `Promise.constructor` which is the global `Function` constructor — to create … | |
| 6 | Remote Code Loading | critical | js/profiler.js (line 26) | The extension fetches a remote config from `https://fri-gate.org/config.txt`, decodes it (base64), parses it, then POSTs the extension ID and full manifest to attacker-controlled URLs from that config. The server resp… | |
| 7 | Unauthorized Data Collection | critical | js/goanalitics.js (line 824) | On every tab navigation completion, the extension dynamically injects a script into the tab that captures the page URL (base64-encoded) and `document.referrer`, then messages them back to the background. This is a cov… | |
| 8 | Network Interception | high | js/bg.js (line 120) | The extension contacts remotely supplied proxy hosts, performs a background OAuth-style web auth flow, then sends the returned token back to those hosts. This gives remote infrastructure ongoing control over proxy boo… | |
| 9 | Network Interception | high | js/proxy.js (line 45) | This code dynamically builds a PAC script that decides which traffic is sent through extension-controlled proxies and which traffic is sent direct. Because the proxy list is remote-configurable and applied at the brow… | |
| 10 | Tracking | high | js/goanalitics.js (line 724) | A load-balancer client contacts `frigateblocklist.com/settings` on startup to obtain the actual tracking server URL (`Endpoint`), which is then stored and used for all subsequent browsing history uploads. This two-sta… | |
| 11 | Unauthorized Data Collection | high | js/bg.js (line 329) | The background page monitors every request on all URLs and builds per-tab records of visited top-level hosts plus related subresource domains. Even though this data appears to feed the UI, it is still broad browsing-h… | |
| 12 | Unauthorized Data Collection | high | js/bg.js (line 225) | Two blocking `webRequest.onBeforeRequest` listeners intercept every HTTP/HTTPS request across all URLs and all resource types. The first records the main-frame URL per tab into `drew.fg.hist`. The second builds a comp… | |
| 13 | Code Injection | medium | manifest.json (line 1) | The manifest explicitly enables `unsafe-eval` in the extension CSP, weakening one of the main protections against script injection and dynamic code execution in privileged extension pages. In a background page with br… | |
| 14 | Tracking | medium | js/goanalitics.js (line 60) | This code generates a persistent UUID, ties it to extension metadata and state, and transmits it to Google Analytics. That is a clear tracking implementation and creates a stable identifier for extension usage telemetry. | |
| 15 | Tracking | medium | js/goanalitics.js (line 53) | The extension generates and persists a UUID per installation (`cid`) and sends it to Google Analytics (tid: UA-127775948-1) alongside the user's browser language, extension version, and enabled state. While UA-based a… | |
